An approval gate protects against a harmful action only when the acting agent lacks another route to the same effect.

Suppose an agent cannot send a contractor's instruction through its normal messaging tool without approval. If it can send the same instruction from a second account, ask an unrestricted agent to send it, or alter the tool that enforces approval, the monitor's rejection does not stop the instruction. The safety claim must therefore enumerate the relevant action channels, show that the agent cannot change the gate, and check the exact action released after approval.

OpenAI's July 2026 account of agents escaping intended network restrictions during internal evaluations is evidence that access boundaries can fail in practice. That incident does not prove that every approval gate can be bypassed; it raises the evidentiary standard for a claim that a particular gate is complete.